Bump Go toolchain to 1.26.5 - #533
Merged
Merged
Conversation
Address GO-2026-5856 (Encrypted Client Hello privacy leak in crypto/tls), a Go standard-library vulnerability present in 1.26.4 and fixed in 1.26.5. CI builds with the version pinned by the go directive in go.mod (all workflows use go-version-file: 'go.mod'), so this was failing the Security / govulncheck job on every branch. Verified: govulncheck reports the vuln under go1.26.4 and reports "No vulnerabilities found" under go1.26.5.
There was a problem hiding this comment.
Pull request overview
This PR updates the repository’s pinned Go toolchain patch version by changing the go directive in go.mod from 1.26.4 to 1.26.5, aligning CI (which reads Go from go.mod) with the version that fixes GO-2026-5856 in the Go standard library.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Changes:
- Bump
godirective to1.26.5to pick up the stdlib fix for GO-2026-5856. - Keep dependency graph unchanged (no
require/replaceupdates implied by this change).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This was referenced Aug 3, 2026
jeremy
added a commit
that referenced
this pull request
Aug 3, 2026
) v0.8.0 shipped a flake that cannot build: #533 raised go.mod to Go 1.26.5 on 2026-07-13 while flake.lock still pinned a nixpkgs carrying 1.26.4, and release prep never updates the lock. Nothing caught it because both safeguards were blind. update-nix-flake.sh ran `nix build ... || true` and then treated the log line nix prints when it starts building as proof of success, so a hard failure reported "vendorHash: verified (build succeeded)". nix-verify was continue-on-error, only runs on tags, and for v0.8.0 never ran at all because the AUR outage skipped every job needing the release job. Update the lock, which then surfaced a second defect the Go error had masked: the recorded vendorHash was stale too. Both fixed; nix build now succeeds and the resulting binary reports its version. Make the check fail closed everywhere it can be invoked. It reads the real exit status, rebuilds to prove any hash it writes, and requires both a fixed-output hash-mismatch diagnostic and an SRI-shaped value before touching the tracked file. The Makefile target propagates failures instead of swallowing them, and the build runs unconditionally, since a toolchain bump outpacing flake.lock changes neither go.mod nor go.sum. Make nix-verify blocking, and add a path-filtered flake build to PR CI so this drift fails its own PR rather than surfacing weeks later at release time. Six regression tests pin the exit-status classification against a stubbed docker, including the exact v0.8.0 log shape.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps the
godirective ingo.modfrom 1.26.4 to 1.26.5 to address GO-2026-5856 — an Encrypted Client Hello privacy leak incrypto/tls, present in the Go standard library at 1.26.4 and fixed in 1.26.5.All CI workflows install Go via
go-version-file: 'go.mod', so the pinned patch version determines the toolchain used. Once this advisory landed in the vuln DB, theSecurity/govulncheckjob started failing on every open branch (it's a stdlib vuln, independent of any code change). This bump clears it.Verification
govulncheck -tags dev ./...under go1.26.4 → exit 3, reportsGO-2026-5856incrypto/tls.go build -tags dev ./...clean;go mod tidyis a no-op (no dependency changes).Unblocks the Security check on the currently-open PRs once they rebase onto main.
Summary by cubic
Update the
godirective ingo.modfrom 1.26.4 to 1.26.5 to patch thecrypto/tlsECH privacy leak (GO-2026-5856). CI uses this pinned version, so this unblocks failinggovulncheckruns.Written for commit ec69e23. Summary will update on new commits.